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What is claimed is : 

*p 1. \ A method for identifying a corresponding session for a packet, comprising: 

(a) receiving at least a first packet communicated between first and second endpoints 
to a first session, the first packet comprising at least one of a network address of the first 
endpoint, a session id of the first endpoint, and a session id of the second endpoint; 

5 (b) comparing the at least one of a network address of the first endpoint, a session id 

of the first endpoint, and a session id of the second endpoint in the packet with a listing of at 
least one of network addresses and session ids contained in previously received packets; and 

(c) when the at least one of a network address of the first endpoint, a session id of the 
first endpoint, and a sessiork id of the second endpoint in the packet matches an entry in the 

10 listing, determining a networ&address of the second endpoint in the first session. 

2. The method of Cfium 1, wherein the packet is transmitted from the first 
endpoint to a session monitor and further comprising before the comparing step (b): 

(d) parsing the packet for at least one selected field; and 

(e) determining whether the network address of the second endpoint is in the selected 
5 field, wherein, when the network address orahe second endpoint is in the selected field, steps 

(b) and (c) are not performed and, when the network address of the second endpoint is not 
in the selected field, steps (b) and (c) are performed. 

3. The method of Claim 1, wherein tft^ comparing step (b) comprises the 
substeps of: 
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i) comparing the at least one of a network address of the first endpoint, a session id 
of the firstWdpoint, and a session id of the second endpoint in the packet with a first listing 
of at least one^of network addresses and session ids contained in previously received packets, 
the first listing corresponding to a list of active sessions for which the network addresses of 
each session participant are known; and 

(e) comparing the at least one of a network address of the first endpoint, a session id 
of the first endpoint, and a session id of the second endpoint in the packet with a second 
listing of at least one of network addresses and session ids contained in previously received 
packets, the second listing>corresponding to a list of active sessions for which the network 
address of at least one participant in a session is not known. 

4. The method of Claim 3 , wherein in step (d), when the at least one of a network 
address of the first endpoint, a session id of the first endpoint, and a session id of the second 
endpoint in the packet is in the first lis\ing, step (e) is not performed and the first listing is 
updated to reflect data in the packet. 

5. The method of Claim 3, whereik in steps (d) and (e), when the at least one of 
a network address of the first endpoint, a session\d of the first endpoint, and a session id of 
the second endpoint in the packet is not in the first listing and is in the second listing, the 
second listing is updated to reflect data in the packet. 
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6. \ The method of Claim 3, wherein, in steps (d) and (e), when the at least one of 
a network address of the first endpoint, a session id of the first endpoint, and a session id of 
the second endpoint in the packet is not in the first and second listings, the at least one of a 
network address of the first endpoint, a session id of the first endpoint, and a session id of the 
5 second endpoint in the packet is added to the second listing. 



7. The method of Claim 3, further comprising after steps (d) and (e) comparing 
entries in the second listing to determine whether at least two entries have a same at least one 
session id and network addrbss. 

8 . The method of ClaiV 7, wherein, when at least two entries have a same at least 
one session ids and network addresses, removing the entries from the second listing and 
adding selected information in the at least two entries to the first listing. 



9. The method of Claim 1, wherein the packet contents are defined by the Real 
Time Transfer Control Protocol. 
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10. \ A system for identifying a corresponding session for a packet, comprising: 



(a) an input configured to receive at least a first packet communicated between first 
and second endpoints to a first session, the first packet comprising at least one of a network 
address of the firk endpoint, a session id of the first endpoint, and a session id of the second 
endpoint; and \ 

(b) a matcher Configured (i) to compare the at least one of a network address of the 
first endpoint, a sessioroid of the first endpoint, and a session id of the second endpoint in the 
packet with a listing of Vt least one of network addresses and session ids contained in 
previously received packets, and (ii) to determine a network address of the second endpoint 
in the first session, when the at least one of a network address of the first endpoint, a session 
id of the first endpoint, and a session id of the second endpoint in the packet matches an entry 
in the listing. \ 

11. The system of Claim \o, wherein the packet is transmitted from the first 
endpoint to a session monitor and further comprising: 

(c) a parser configured to parse the^packet for at least one selected field; and 
wherein the matcher is further configured (iii) to determine whether the network 

address of the second endpoint is in the selected field. 

12. The system of Claim 10, wherein \he matcher is further configured (iii) to 
compare the at least one of a network address of thd first endpoint, a session id of the first 
endpoint, and a session id of the second endpoint in tHs packet with a first listing of at least 
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A^V^ of network addresses and session ids contained in previously received packets, the first 
5 listing corresponding to a list of active sessions for which the network addresses of each 

sessioh participant are known and (iv) to compare the at least one of a network address of the 
first endpoint, a session id of the first endpoint, and a session id of the second endpoint in the 
packet witL a second listing of at least one of network addresses and session ids contained 
in previously received packets, the second listing corresponding to a list of active sessions for 
10 which the network address of at least one participant in a session is not known. 

13. The system of Claim 12, wherein, when the at least one of a network address 
of the first endpoint, a session id of the first endpoint, and a session id of the second endpoint 
in the packet is in the first listing, the matcher is further configured (v) to update the first 
listing to reflect data in the packet. 

14. The system of Claim\12, wherein, when the at least one of a network address 
of the first endpoint, a session id of theNfirst endpoint, and a session id of the second endpoint 
in the packet is not in the first listing tfnd is in the second listing, the matcher is further 
configured (v) to update the second listingNto reflect data in the packet. 



15. The system of Claim 12, whereiiWhen the at least one of a network address 
of the first endpoint, a session id of the first endpoint and a session id of the second endpoint 
in the packet is not in the first and second listings, the matcher is further configured (v) to add 
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the at least one of a network address of the first endpoint, a session id of the first endpoint, 
and a session id of the second endpoint in the packet to the second listing. 



16. \ The system of Claim 12, wherein the matcher is further configured (v) to 
compare entnfes in the second listing to determine whether at least two entries have a same 
at least one session id and network address. 



17. The sWem of Claim 16, wherein, when at least two entries have a same at 
least one session ids ancl network addresses, the matcher is configured (vi) to add the at least 
two entries to the first list» 
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18. \ A method for monitoring a multi-party session, comprising: 

(a) receiving, at a first endpoint, at least a first packet communicated between the first 
endpoint and a second endpoint to a first session, the first packet comprising a network 
address of the first Wipoint and a network address of the second endpoint; and 

(b) transmitting at least a second packet to a session monitor, the at least a second 
packet including the respective first and second network addresses of the first and second 
endpoints. 



19. The method of Claim 18, further comprising: 
determining a value of a flag; 

and wherein, when the flag has a first predetermined value, performing step (b) and, 
when the flag has a second predetermined value, not performing step (b). 



20. \ The method of Claim 18 further comprising: 
(c) receiving the transmitted packet; 

(b) comparing at least one of the first and second network addresses with a listing of 
at least one of networ^c addresses and session ids contained in previously received packets; 
and 

(c) when the at leas\pne of the first and second network addresses is in the listing, 
updating the listing to reflect o^ta in the packet and when the at least one of the first and 
second network addresses is not iirthe listing, adding the at least one of the first and second 
network addresses to the listing. 
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l An endpoint in a session, comprising: 

(a) an input operable to receive, at a first endpoint, at least a first packet 
communicated bettveen the first endpoint and a second endpoint to a first session, the first 
packet comprising a \etwork address of the first endpoint and a network address of the 
second endpoint;. and 

(b) a transmitter ofterable to transmit at least a second packet to a session monitor, 
the at least a second packet including the respective first and second network addresses of the 
first and second endpoints. 

22. The endpoint of Claim 21, wherein the first packet includes a flag and 
wherein, when the flag has a first predetermined value, the transmitter transmits the at least 
a second packet and, when the flag has a second predetermined value, the transmitter does 
not transmit the at least a second packet. 

T 

23. *Hie endpoint of Claim 21 further comprising: 

(c) a second input operable to receive the transmitted second packet; and 

(b) a matcherVperable (i) to compare at least one of the first and second network 
addresses with a listingW at least one of network addresses and session ids contained in 
previously received packets; (ii), when the at least one of the first and second network 
addresses is in the listing, to update the listing to reflect data in the packet and (iii), when the 
at least one of the first and seconasnetwork addresses is not in the listing, to add the at least 
one of the first and second network addresses to the listing. 
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session packet for transmission on a network, comprising: 
a source network address of a first participant to a session; 
a destinationSietwork address associated with a session monitor; 
a network address of a second participant to the session; and 
session information\ssociated with the session. 

25. The session packet of Claim 24, further comprising: 
a first session id associated with the first participant; and 
a second session id associated with the second participant. 



26 . The session packet of Claim 24, wherein the contents of the session packet are 
defined by the Real Time Control Protocol. 
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Pfi / 27. V A method for monitoring a multi-party session, comprising: 

receiving a packet from a first endpoint in a first session, the first session being 
between the firsftendpoint and a second endpoint, the packet comprising a first network 
address of the first endpoint as the source, a second network address of the second endpoint, 
and a network address of a session monitor as the destination; and 

inputting infortnation in the packet in a first entry in an active session table, the first 
entry corresponding to me first session. 

28. The method of Claim 27, wherein the inputting step comprises: 
comparing at least one of the first and second network addresses to the active session 
table to determine whether the %st session has a corresponding first entry in the active 
session table; and 

when the active session table htas no corresponding entry, creating the first entry in the 
active session table. 



29. The method of Claim 27, wherein the packet is defined by the Real Time 
Control Protocol and the network address okthe second endpoint is in the application field. 

3 0 . The method of Claim 27, wherein the packet is transmitted by the first endpoint 
to the session monitor in a uni-cast configuration. 
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